Hi @rbrisseyii what I tend to do in this situation is my search | stats count by Microservice SiteType | eval Microservice_SiteType_count = MicroService + " " + SiteType + " = " + count + "alerts" | stats values(Microservice_Sitetype_count) as Microservice_counts And then I use $result.Microservice_counts$ in your alert You can format the eval however you like. The idea is you are creating field Microservice_SiteType_count for each Microservice SiteType pair And then finally you are looking at the values of all those pairs and you can grab it in your alert by using $result.Microservice_counts$ ... View more

What is the capacity/Azure SKU you would suggest for an environment that would be forwarding 10 TB of data per day? I see per Splunk Documentation, for large scale deployment, they recommend to use Standard_D15_v2 - 5 instances indexing 1 TB of data with search load from 8 concurrent users. https://www.splunk.com/pdfs/technical-briefs/deploying-splunk-enterprise-on-microsoft-azure.pdf https://docs.microsoft.com/en-us/azure/virtual-machines/dv2-dsv2-series-memory?toc=/azure/virtual-machines/linux/toc.json&bc=/azure/virtual-machines/linux/breadcrumb/toc.json ... View more